CVE-2025-69256 serverless MCP Server vulnerable to command injection in list-projects tool

The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package @serverless/mcp. This...

CVE-2025-69256 serverless MCP Server vulnerable to command injection in list-projects tool

The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to version 4.29.3, a command injection vulnerability exists in the Serverless Framework's built-in MCP server package @serverless/mcp. This...

CVE-2025-68950

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file wi...

CVE-2025-69025

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through = 1.0.20...

OESA-2025-2906 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: A flaw was found in...

MAL-2025-192962 Malicious code in rippling-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bac12bb851f49ac4801addcf6964c854abe90430140d3e75e4eefcd4c7cf1bf0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

EUVD-2025-205702

Malicious code in rippling-cli PyPI...

[SECURITY] [DLA 4426-1] osslsigncode security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4426-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA December 30, 2025 https://wiki.debian.org/LTS -...

Exploit for CVE-2025-14847

CYBERDUDEBIVASH MONGODB DETECTOR TOOL v2026.1 Detect expose...

Exploit for CVE-2025-14847

MongoBleed-Pro ☠️ Advanced MongoDB Memory L...

Exploit for Deserialization of Untrusted Data in Facebook React

🎯 CVE-2025-55182-advanced-scanner- - Detect and Exploit Vulner...

Maxun 授权问题漏洞

Maxun is a crawler tool from Maxun open source. An authorization issue vulnerability exists in Maxun 0.0.28 and earlier versions, which stems from an incorrect operation of the function router.get in the file server/src/routes/auth.ts, which could lead to improper authorization...

EUVD-2025-205454

n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell Scanner – CVE-2025-55182 🔐 Ferramenta educacion...

📄 Backdoor.Win32.ControlTotal.t Hardcoded-Password Backdoor

This tool was design to leverage a hardcoded password backdoor in Backdoor.Win32.ControlTotal.t to simulate communications with the malware. ============================================================================================================================================= | Title :...

📄 Backdoor.Win32.Netbus.170 Blind Command Execution

This Metasploit module provides historical/educational exploitation of the Backdoor.Win32.Netbus.170 trojan, originally discovered in 1998. It represents a legacy proof-of-concept rather than a modern offensive security tool...

IBM Concert 安全漏洞

IBM Concert is a generative artificial intelligence-driven automated application management and monitoring tool based on the watsonx platform, announced by IBM in May 2024 at the IBMThink conference in Boston, USA. IBM Concert suffers from a competitive condition vulnerability that stems from a...

Exploit for CVE-2025-68613

n8n Authenticated Expression Injection RCE – CVE-2025-68613...

Exploit for Deserialization of Untrusted Data in Facebook React

🚀 NextjsRCEExploitTool - Easy Way to Test Security Flaws...

ThreatsDay Bulletin: Stealth Loaders, AI Chatbot Flaws AI Exploits, Docker Hack, and 15 More Stories

It's getting harder to tell where normal tech ends and malicious intent begins. Attackers are no longer just breaking in — they're blending in, hijacking everyday tools, trusted apps, and even AI assistants. What used to feel like clear-cut "hacker stories" now looks more like a mirror of the...